Child Safeguarding Standards at a Physiotherapy Practice - a Legal Duty, Not an Option

Ania runs a one-person physiotherapy practice. Most of her patients are adults recovering from orthopaedic injuries, but once a week she also treats eight-year-old Kuba for a postural issue, referred by his mother through word of mouth. When someone in a local physiotherapists' group posted that, since August 2024, every practice treating children must have written Child Safeguarding Standards in place, Ania assumed it surely only applied to schools and kindergartens. After all, she sees one minor a week -- she doesn't run a nursery.

She was wrong -- and this is the most common mistake physiotherapists across Poland make. The regulation doesn't ask how many minor patients you have, or whether paediatric physiotherapy is your specialty. It only takes one child patient for the duty to have Child Safeguarding Standards to apply, exactly as it would at a large paediatric clinic. In this article we explain where this obligation comes from, what the safeguarding document must actually contain, and how to implement it at a practice without a large budget or a legal team.

Where the SOM duty comes from -- the "Kamilek's Law"

The legal basis is the Act of 13 May 2023 on Counteracting Threats of Sexual Crime and Protecting Minors, widely known as "Kamilek's Law" (ustawa Kamilka). It entered into force on 15 February 2024, and from 15 August 2024 the key provision for practices has been in effect: every entity conducting activity related to the care or education of minors must have implemented Child Safeguarding Standards (Standardy Ochrony Małoletnich, SOM).

The legislator deliberately did not limit this duty to educational institutions. The definition of "activity related to the care of minors" covers any form of regular contact with children within the services provided -- and treating paediatric patients for therapy falls squarely within it. It doesn't matter that physiotherapy isn't "care" in the everyday, educational sense. What matters is that a child is on the premises under the supervision of staff, often without a parent present during the treatment itself.

Who exactly is covered

The SOM duty applies, among others, to:

• one-person physiotherapy practices treating even a single minor patient,
• group practices and physiotherapy clinics, whether or not they have a dedicated paediatric department,
• practices providing therapy to children at the patient's home (home visits),
• entities working with contracted physiotherapists, if those therapists treat minors.

The scale of the business doesn't matter. The law sets no patient-count threshold or revenue limit below which the duty doesn't apply. If even one child's visit appears on your calendar per year, you should already have SOM implemented.

It's worth comparing this to other formal duties at a practice, since some physiotherapists confuse SOM with documents they already have. For more on not getting lost in compliance requirements, see our article on the most common compliance mistakes at physiotherapy practices.

What the SOM document must contain

Child Safeguarding Standards aren't a single page with a general statement like "we care about children's safety." The law specifies the minimum content of the document, and inspecting bodies check it point by point.

Rules for safe staff recruitment

The document must describe how the entity verifies people before allowing them to work with minors -- including trainees and interns who have even occasional contact with children at the practice. A key element is verification in the Register of Sex Offenders (Rejestr Sprawców Przestępstw na Tle Seksualnym, RSPTS). This check must happen before the person is allowed to work with children, not "at some point" a few months into employment.

Competencies of the person responsible for SOM

At a one-person practice, this is usually the owner. At larger entities, the document must specify who holds this role, what their scope of duties is, and what competencies they need to effectively monitor compliance with the standards.

Rules for safe staff-child relationships

This section describes what behaviour is and isn't acceptable in contact with a minor patient -- for example, rules around physical contact during treatment (which matters a great deal in physiotherapy, since working with a child's body is an inherent part of the treatment), a parent's presence in the treatment room, and communication outside of visits.

Procedures for responding to suspected harm

The document must include two separate response paths:

• an internal procedure -- what staff do when they notice worrying signs (bruising, changes in behaviour, concerning relationships around the child),
• an external procedure -- when and how to report the matter to a family court, the police, or the prosecutor's office.

This is one of the most frequently skipped elements, because physiotherapists assume they'll "report it if they notice something," without having a written path for doing so. In practice, the lack of a procedure means delay and confusion in a situation that demands a fast response.

Rules for minors' use of the internet on the premises

If the practice has wi-fi access, a tablet in the waiting room, or a computer a child could use, the document must set out rules for minors' safe use of the internet and devices.

Documenting and storing reported incidents

The final mandatory element is how disclosed or reported cases of harm are documented, and the rules for storing that information -- in line with confidentiality principles and restricted access to such records.

SOM document element	What it covers	Who it applies to at a practice
Safe recruitment	RSPTS verification before allowing work with children	All staff, trainees, interns
Person responsible for SOM	Scope of competencies and duties	Owner or designated person
Safe staff-child relationships	Rules on contact, including physical contact, during therapy	Therapists treating minors
Internal procedure	Staff response to suspected harm	All staff
External procedure	Reporting to family court / police / prosecutor	Person responsible for SOM
Internet use rules	Children's safety around devices on the premises	Waiting room, treatment room
Incident documentation	How reports are recorded and stored	Person responsible for SOM

The child-friendly summary of SOM

The law also requires a shortened version of the standards, adapted to a child's language, to be displayed somewhere accessible to minors -- typically the waiting room or the entrance. It's a short, simple text explaining to the child that they have the right to feel safe, who they can turn to if something worries them, and that the adults at the practice are obligated to protect them. The full version of SOM, written in legal language, doesn't satisfy this requirement on its own -- two separate documents are needed.

Verifying staff in the RSPTS register -- how it works in practice

The Register of Sex Offenders is maintained by the Ministry of Justice, and the check is done through the register's website. The verification duty applies to every person who will have contact with minor patients -- not just physiotherapists employed under an employment contract, but also people on B2B contracts, trainees, and interns.

A printout or screenshot of the check result should be kept as evidence that verification actually took place before the person started working with children. At a small practice that's a single sheet in the SOM binder -- but its absence is the first thing an inspecting body will look for.

[SP] Example -- Solo practice: After reading about SOM, Ania checks herself in the RSPTS register, prints the result, writes a one-page procedure for responding to suspected harm, and puts the child-friendly summary up in the waiting room. The whole process takes her under two hours, and from then on she treats every new minor patient knowing she's acting within the law.

[GR] Example -- Group practice: At a clinic with eight therapists and a dedicated paediatric department, SOM requires more organisational work -- every therapist and every trainee needs to be checked in the RSPTS register, one person needs to be designated to monitor the standards, and all staff need training on the harm-response procedure so everyone knows who to report a worrying sign to.

How to implement SOM in a day at a small practice

For a one-person practice, implementing SOM doesn't take months of work. A practical order of steps:

1. Check yourself in the RSPTS register and keep evidence of the check -- this takes a few minutes.
2. Write the internal and external procedures for responding to suspected harm -- who you call, what you note down, and by when you escalate the matter.
3. Describe the rules for safe contact with a child during therapy -- including whether a parent is present in the room and the physical-contact norms typical of physiotherapy treatment.
4. Set the rules for internet and device use by minors on the premises, even if you only have one tablet in the waiting room.
5. Decide how you'll document and store any reports -- one page describing the procedure and where records are kept is enough.
6. Prepare and display the child-friendly summary in the waiting room, somewhere clearly visible.
7. Sign and date the whole document -- SOM should have a clear implementation date, because that's the first thing an inspection will ask about.

If you treat children regularly, it's worth pairing this process with a review of parental consent forms for therapy -- both documents concern the same group of patients and are often checked together. For more on collecting consent correctly, see our article on paediatric physiotherapy and parental consent.

Penalties for not having SOM

The consequences of not having implemented Child Safeguarding Standards aren't symbolic. Under Articles 23-24 of the Act, the head of an entity who fails to fulfil the duty to have and implement SOM is liable to a fine, restriction of liberty, or imprisonment for up to 3 years. At a one-person practice, the "head of the entity" is the practice owner -- the physiotherapist running the business.

This sets SOM apart from many other formal duties in the industry, where the sanction is usually an administrative fine or a post-inspection recommendation. Here, the legislator built in criminal liability, which signals how seriously this area is treated.

Who checks SOM compliance

In practice, verification of SOM compliance can come up during various inspections, not necessarily ones dedicated solely to this topic. Physiotherapists most often encounter a question about SOM during routine site visits, including a KIF inspection at their practice, where the inspector may ask to see the document alongside patient records and consent forms. An inspection can also stem from a report, a parent's complaint, or routine oversight of entities working with children.

There is no single dedicated "SOM inspector" who automatically visits physiotherapy practices -- but a missing document surfaces at the first opportunity, and at that point liability falls directly on the head of the entity.

SOM is not GDPR and not your organisational regulations

One of the most common mistakes among physiotherapists is assuming that, having already implemented GDPR and written up organisational regulations for the practice, the child-protection topic is "somehow covered." That's not true -- SOM is a separate, standalone document, required under an entirely different act, with a different purpose and scope.

• GDPR governs the processing of patients' personal data, including children's, but says nothing about procedures for responding to harm or about staff verification in the RSPTS register.
• Organisational regulations describe the general rules for how the practice operates -- opening hours, scope of services, booking rules -- but don't replace detailed child-safeguarding procedures.
• SOM focuses exclusively on children's safety: recruitment, relationships, responding to harm, and documenting incidents.

Having one of these documents doesn't exempt you from having the others. All three must exist in parallel and complement one another.

Frequently asked questions

Does a one-person physiotherapy practice need SOM if it only treats one child a week?

Yes. The law sets no patient-count or scale-of-activity threshold that the duty depends on. It only takes the practice treating even a single minor patient for the duty to have and implement SOM to apply, in force since 15 August 2024.

How is SOM different from a parent's consent to a child's therapy?

They're two separate documents with different purposes. Parental consent relates to a specific patient and specific therapy -- it authorises the physiotherapist to carry out defined treatment. SOM is a systemic document covering the whole entity, describing safety rules, staff verification, and harm-response procedures for all minor patients, regardless of any individual consent.

Does a trainee or intern also need to be verified in the RSPTS register?

Yes. The duty to verify people in the Register of Sex Offenders applies to everyone who has contact with minor patients within the entity's activity, regardless of employment or cooperation form. A trainee observing treatments involving children is subject to the same rule as a permanently employed physiotherapist.

What are the penalties for not having SOM implemented at a practice?

Under the Act, the head of an entity who fails to fulfil the duty to have and implement Child Safeguarding Standards is liable to a fine, restriction of liberty, or imprisonment for up to 3 years. At a sole proprietorship, this liability falls directly on the practice owner.

CTA: Compliance at a physiotherapy practice isn't just medical records and GDPR -- it also includes duties like SOM that are easy to overlook while running a practice day to day. See how FizjoReady packages support getting your practice's paperwork comprehensively in order. See FizjoReady packages →

Related articles:
- KIF inspection at your practice -- what to expect and how to prepare
- Paediatric physiotherapy -- parental consent
- Most common compliance mistakes at physiotherapy practices